SB20260422163 - Multiple vulnerabilities in Siebel CRM Deployment

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2025-48924)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. A remote attacker can trigger uncontrolled recursion and perform a denial of service (DoS) attack.

2) Resource exhaustion (CVE-ID: CVE-2023-26464)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (i.e., deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed can exhaust the available memory in the virtual machine and achieve denial of service when the object is deserialized.

3) Resource exhaustion (CVE-ID: CVE-2025-58057)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in BrotliDecoder and some other decompressing decoders. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuapr2026.html?1007000